Eric Herberholz blog at blogsome.com

The
purpose of this
document is to describe how memory is used and the tools, both
supported and unsupported, that are availble to examine/report memory
usage.  See below for details.

Monitoring Memory Usage

• There
  are 3 ways for memory to be allocated, all requiring an
  equivalent amount of swap.

1. plain memory as allocated with  malloc(3C) system call.
2. shared memory as allocated with shmget(2)
   system call.
3. memory mapped files as allocated with mmap(2) system call. 

1. plain memory

• Allocated by malloc(3C) system call.
• Can be examined with: ps, procsize, kmeminfo, and glance. 
• Used by process’ data space, stack space, and text space
• Limited by kernel parameters:
• maxdsiz(5), maxssiz(5), and maxtsiz(5) respectively, for 32-bit apps
• maxdsiz_64bit(5), maxssiz_64bit(5), and maxtsiz_64bit(5) respectively, for 64-bit apps
2. shared memory 
• Allocated by shmget(2) system call.
• Can be examined with ipcs and with unsupported utilities called procsize, and shminfo. 
• Limited by kernel parameter:
• shmmax(5)
3. memory mapped files
• Allocated by mmap(2) system call.

• Can be examined with unsupported utilities called shminfo and procsize
• Limited by availability of virutal memory.

• ps  

• $ UNIX95= ps -eo vsz,ruser,pid,args | sort -rn | more

  
  26332 ids       1685 ./idsagent -a
  
     5296 root      2178 /usr/sbin/stm/uut/bin/tools/monitor/fpl_em
  
     4760 root      2713 /opt/perf/bin/rep_server -t SCOPE /var/opt/perf/datafiles/loggl
  
     4068 root      1487 /opt/perf/bin/scopeux
  
     4052 root      1243 /opt/dce/sbin/rpcd
  
     3364 root      2715 /opt/perf/bin/alarmgen -svr 2714 -t alarmgen /var/opt/perf/data
  
     3180 root      1465 /opt/perf/bin/midaemon
  
     3148 root      1495 /usr/sbin/swagentd -r

• Look at the 1st column
  in the output to
  see the amount of memory used by this process for data/text and stack.
  This value is in pages, so multiply by 4096 to determine the
  size in bytes. 
  Anytime
  you see that the size (SZ) is a four-digit number, that’s relatively large, so it’s one to watch over time
  and to see if it continues to grow, and therefore may have a memory leak.
• If you see a process called  mib2agt using an excessive amount of
  memory, this binary, mib2agt, has a known memory leak fixed
  in an 11.X patch called  PHSS_27858  (ITRC
  ftp site download).  This
  patch DOES NOT require a reboot. Furthermore, mib2agt can be killed and then restarted with “kill mib2agt_PID”
  and “/usr/sbin/mib2agt”. But only restart it if you have need of
  supporting SNMP requests (e.g. OpenView). If not needed, can be
  configured to not start at bootup by modifying /etc/rc.config.d/SnmpMib2.

• procsize

• kmeminfo

• glance 

• shminfo 

• ipcs

• And if total is at or near 1.75 Gb or 2.75Gb
  then address as a 32-bit
  limitation issue.

• To find processes, if still running, that last touched (LPID) shared memory segments:

• $ ps -ef | `ipcs -mpb | sed -n ‘/^m/p’ | \

      awk ‘{printf(”%s “, $NF)} END{printf(”\n”)}’ | \

      sed ’s/\ /\|/g’| sed ’s/\|$//’ | \

      awk ‘{printf(”egrep -e %s\n”,$0)}’ | \

      sed ’s/ \-e / \-e \”/’ |sed ’s/$/\”/’`

Blogged with Flock

nflocks(5) - number of file locks

• References

• nflocks(5) man page
  

• HPUX OS: Determining nflock Usage Using lsof(8)
• Sys Adm: displaying the usage of the file lock table on HP-UX 11
• Sys Adm: displaying the number of used file lock   (using q4 in a script*)

• Check /var/adm/syslog/syslog.log

• it is the application’s responsibility to write to syslog regarding inability to obtain a file lock
  
• for example:
  Jun 24 17:13:11 usnbru25 smbd[5407]:   nt_printing_init: Failed to open nt formsdatabase /var/opt/samba/locks/ntforms.tdb (No locks available)

• Monitoring file lock usage - with Glance, with q4 script, or with lsof…

• Glance shows “File Locks (nflocks)” usage in the System Tables screen. (keyboard short cut is ‘t’). To monitor usage, here’s a glance adviser script below.  This script can be run periodically from cron to monitor nflocks usage over time.